Who did that?

Compliance in the cloud

Compliance means meeting the laws, regulations and standards that apply to your business. Governance is how a company sets and enforces its own rules: who may do what, how changes are approved, what gets logged. AWS has its infrastructure independently audited for many programs (ISO 27001, System and Organization Controls (SOC) reports, PCI DSS for card payments, and more). Under shared responsibility, AWS proves its part; the customer still has to make its own workload compliant.

Exam tip Trap: "AWS is PCI DSS compliant" doesn't make your shop compliant. It gives you a compliant foundation to build on.

AWS Artifact: the paperwork drawer

AWS Artifact is the self-service portal in the console for AWS's own compliance documents. Artifact Reports gives on-demand downloads of AWS audit reports, such as SOC reports and PCI attestations, to hand to auditors. Artifact Agreements lets you review and accept agreements with AWS, such as the Business Associate Addendum (BAA) needed for US health data.

Maya: So when the processor asks for AWS's PCI report, I download it from Artifact. No phone calls.

Requirements vary by place, industry and service

What you must follow depends on where you operate and what you do. Customer data of people in the European Union falls under the General Data Protection Regulation (GDPR); some countries require data to stay inside their borders. Card payments bring the Payment Card Industry Data Security Standard (PCI DSS); US health data brings HIPAA. And not every AWS service is covered by every program: AWS publishes which services are in scope for each one, so check before you build.

Exam tip HIPAA is the US Health Insurance Portability and Accountability Act. Exam phrase "compliance requirements vary among AWS services" = check the services-in-scope list.

At rest and in transit

Encryption at rest protects stored data: disks, databases, files in Amazon Simple Storage Service (Amazon S3). Encryption in transit protects data moving across a network, usually with Transport Layer Security (TLS), the lock behind Hypertext Transfer Protocol Secure (HTTPS). A stolen disk or a snooped connection shows only scrambled data. One benefit of cloud security: encryption is built in and often just a setting. New objects in Amazon S3 are encrypted at rest by default.

Who holds the keys

Encryption is only as good as its keys. AWS Key Management Service (AWS KMS) creates and controls encryption keys and works with most AWS services, so turning on encryption is usually one checkbox. AWS CloudHSM gives you your own dedicated hardware security module (HSM) when rules require single-tenant key hardware you fully control. AWS Certificate Manager (ACM) provides and renews the TLS certificates used for encryption in transit.

Exam tip Keys managed for you, integrated everywhere = KMS. Dedicated hardware you control = CloudHSM. Certificates for HTTPS = ACM.

AWS CloudTrail: who did what

AWS CloudTrail records actions taken in your AWS account: every API call from the console, command line interface (CLI) or software development kits (SDKs). Each event shows who acted, what action, on which resource, when, and from which Internet Protocol (IP) address. The last 90 days of management events are viewable in event history; create a trail to keep logs longer in an S3 bucket. CloudTrail is your audit trail for security investigations and compliance.

Amazon CloudWatch: how is it doing

Amazon CloudWatch monitors resources and apps: metrics (processor (CPU) use, request counts), CloudWatch Logs (app and system log files collected in one place) and alarms that alert or act when a metric crosses a line. It answers "is the shop healthy right now?", not "who changed it?"

AWS Config: what did it look like

AWS Config records the configuration of your resources over time, so you can see what a security group or bucket looked like last Tuesday and what changed. Config rules check resources against your policies, such as "every bucket must be encrypted", and flag ones that are noncompliant.

Exam tip CloudTrail = who did what (actions). CloudWatch = how is it doing (performance). Config = what did it look like (settings history and compliance).

Access reports

IAM offers reports for reviewing access. The IAM credential report lists every user and the status of their passwords, multi-factor authentication (MFA) and access keys (you used it on the root key). Last accessed information shows which services a user or role actually used, so you can trim unused permissions. IAM Access Analyzer finds resources shared outside your account and unused access.

Priya: Logs prove what happened. Access reports prove who could have done it.

The main log sources

Security logs in AWS come from several services, each answering a different question. Turn them on early: you can't investigate what was never recorded.

• AWS CloudTrail: who did what, when and from where. Records API calls (console, CLI, SDK) in your account; use it to investigate changes
• Amazon CloudWatch Logs: application and OS logs, and metrics and alarms
• VPC Flow Logs: which IP traffic went in and out of network interfaces (accepted or rejected)
• AWS Config: a history of resource configurations and whether they follow your rules
• Amazon S3 server access logs and Elastic Load Balancing access logs
• Logs are commonly stored in an S3 bucket and analyzed with Amazon Athena or sent to Amazon CloudWatch

Exam pattern

'Who deleted the S3 bucket?' = CloudTrail. 'What did this security group look like last week?' = AWS Config. 'Which IP addresses were rejected?' = VPC Flow Logs. 'Alert when CPU is high' = CloudWatch.

Exam tip CloudTrail is on by default for 90 days of management events in Event history; create a trail to keep logs longer in S3.

The words

Compliance means meeting laws, regulations and standards (for example HIPAA, PCI DSS, GDPR, ISO 27001, SOC). Governance means the rules and controls a company uses to make sure accounts are used the way it intends: who can create what, where, and at what cost.

Governance tools

These services put the rules into practice across accounts.

• AWS Organizations: group accounts, consolidated billing, service control policies (SCPs) that set the maximum permissions in member accounts
• AWS Control Tower: sets up a governed multi-account environment (landing zone) with guardrails
• AWS Config: checks resources against rules and records changes
• AWS CloudTrail: audit trail of API activity
• AWS Audit Manager: collects evidence for audits
• Tags and AWS Service Catalog: control and track what's deployed

Remember

AWS being certified (for example PCI DSS compliant infrastructure) doesn't make your application compliant: you still have to configure your part correctly (shared responsibility).

Exam tip Need to stop every account in the organization from using a Region or service: SCP in AWS Organizations.

What you get by default

Security is built into the platform, so small teams get controls that were once expensive.

• Encryption everywhere, often one checkbox or on by default (for example new S3 objects are encrypted at rest)
• Managed keys with AWS KMS
• Detailed logging and audit trails (CloudTrail, Config)
• Physical security, certifications and audits handled by AWS
• Automated threat detection (Amazon GuardDuty) and central findings (AWS Security Hub)
• Fine-grained access control with IAM

In short

You inherit AWS's data center controls and compliance certifications, and you can automate security checks across all accounts instead of auditing servers by hand.

What Artifact holds

AWS Artifact is a free self-service portal in the console for AWS's compliance reports (for example SOC reports, PCI DSS attestation, ISO certifications) and agreements (for example the Business Associate Addendum for HIPAA). Auditors often ask for these.

• Artifact Reports: download third-party audit reports about AWS
• Artifact Agreements: review and accept agreements for your account or organization

Other places

The AWS Compliance Programs page lists which standards AWS meets; Services in Scope lists which services each program covers; AWS Customer Compliance Guides and the security pillar of the Well-Architected Framework explain your side.

Exam tip 'An auditor needs AWS's SOC 2 report' = AWS Artifact.

Data stays where you put it

AWS doesn't move your data out of the Region you choose. That matters for data residency and sovereignty laws (for example GDPR in the EU, or a country requiring citizen data to stay in-country): pick a Region in that location, and use SCPs to block other Regions.

Industry rules

Different industries follow different standards: HIPAA (US healthcare), PCI DSS (card payments), FedRAMP (US government; AWS GovCloud (US) Regions), FERPA (education), SOX (public companies' finances). Check AWS Compliance Programs and Services in Scope to see which services qualify, then configure them correctly.

Exam tip Government workloads with strict US requirements: AWS GovCloud (US).

In transit

Data moving over a network is protected with TLS (HTTPS). AWS service endpoints support TLS; you can require it (for example an S3 bucket policy that denies non-HTTPS requests). AWS Certificate Manager (ACM) issues and renews TLS certificates for load balancers and CloudFront. Site-to-site traffic can use AWS VPN (IPsec).

At rest

Stored data is encrypted on disk: S3 (on by default with S3-managed keys), EBS volumes, RDS databases, DynamoDB and more. Keys are managed in AWS Key Management Service (AWS KMS): AWS managed keys, or customer managed keys you control (rotation, key policies, disabling). AWS CloudHSM gives you a dedicated hardware security module when rules require single-tenant key storage.

• Server-side encryption: the service encrypts for you
• Client-side encryption: you encrypt before upload

Exam tip KMS = managed, multi-tenant, integrated with services. CloudHSM = dedicated hardware you manage.

The services

Services for running, watching and controlling an AWS environment:

• Amazon CloudWatch: metrics, logs, alarms and dashboards
• AWS CloudTrail: API activity history
• AWS Config: resource configuration history and rules
• AWS Organizations and AWS Control Tower: multi-account management and guardrails
• AWS Systems Manager: operate EC2 and on-premises servers (patching, Run Command, Session Manager)
• AWS CloudFormation: infrastructure as code
• AWS Trusted Advisor and AWS Health Dashboard
• AWS Service Catalog, AWS License Manager, AWS Compute Optimizer, AWS Well-Architected Tool

Telling them apart

Performance and alarms = CloudWatch. Who did it = CloudTrail. What changed in the configuration = Config. Is AWS having an outage that affects me = AWS Health Dashboard.